THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-vx89-p3j7-8xqc (medium) — Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

[GHSA] GHSA-vx89-p3j7-8xqc (medium) — Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

medgithub_advisoriesPublished 2026-08-06

GHSA-vx89-p3j7-8xqc Severity: medium CVE: CVE-2026-71435

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

### Impact

The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients

### Patches

This has be

Indicators of compromise

CVE-2026-71435cve

Original source: https://github.com/advisories/GHSA-vx89-p3j7-8xqc